tls.go

package kmstls

import (
	"crypto/tls"
	"crypto/x509"
	"fmt"
	"os"

	"code.fbi.h-da.de/danet/quant/goKMS/config"
	"google.golang.org/grpc/credentials"
	"google.golang.org/grpc/credentials/insecure"
)

func GenerateGRPCServerTransportCredsBasedOnTLSFlag(tlsConfig config.TLSConfig) (credentials.TransportCredentials, error) {
	var gRPCTransportCreds credentials.TransportCredentials
	if tlsConfig.Active {
		tlsLibraryConfig, err := GenerateServerTLSLibraryConfig(tlsConfig)
		if err != nil {
			return nil, err
		}

		gRPCTransportCreds = credentials.NewTLS(tlsLibraryConfig)
	} else {
		gRPCTransportCreds = insecure.NewCredentials()
	}

	return gRPCTransportCreds, nil
}

func GenerateServerTLSLibraryConfig(tlsConfig config.TLSConfig) (*tls.Config, error) {
	cp := x509.NewCertPool()
	b, err := os.ReadFile(tlsConfig.CAFile)
	if err != nil {
		return nil, err
	}

	if !cp.AppendCertsFromPEM(b) {
		return nil, fmt.Errorf("credentials: failed to append certificates")
	}

	cert, err := tls.LoadX509KeyPair(tlsConfig.CertFile, tlsConfig.KeyFile)
	if err != nil {
		return nil, err
	}

	return &tls.Config{
		MinVersion:   tls.VersionTLS13,
		ClientCAs:    cp,
		Certificates: []tls.Certificate{cert},
		ClientAuth:   tls.RequireAndVerifyClientCert,
	}, nil
}

func GenerateGRPCClientTransportCredsBasedOnTLSFlag(tlsConfig config.TLSConfig) (credentials.TransportCredentials, error) {
	var gRPCTransportCreds credentials.TransportCredentials
	if tlsConfig.Active {
		tlsLibraryConfig, err := GenerateTLSLibraryConfig(tlsConfig)
		if err != nil {
			return nil, err
		}

		gRPCTransportCreds = credentials.NewTLS(tlsLibraryConfig)
	} else {
		gRPCTransportCreds = insecure.NewCredentials()
	}

	return gRPCTransportCreds, nil
}

func GenerateTLSLibraryConfig(tlsConfig config.TLSConfig) (*tls.Config, error) {
	cp := x509.NewCertPool()

	b, err := os.ReadFile(tlsConfig.CAFile)
	if err != nil {
		return nil, err
	}
	if !cp.AppendCertsFromPEM(b) {
		return nil, fmt.Errorf("credentials: failed to append certificates")
	}

	cert, err := tls.LoadX509KeyPair(tlsConfig.CertFile, tlsConfig.KeyFile)
	if err != nil {
		return nil, err
	}

	return &tls.Config{
		MinVersion:         tls.VersionTLS13,
		RootCAs:            cp,
		Certificates:       []tls.Certificate{cert},
		InsecureSkipVerify: tlsConfig.InsecureSkipVerify,
	}, nil
}